My latest (July 9) Suitwatch contrasts the cultures of DIY-IT and open source with the cultures of large company IT departments where the virtues that matter most are audit, control, business continity, six nines of uptime, Xtreme security and so on. The background was my recent journey to a pair of conferences — Supernova and ISACA — that focused on decentralization and centralization, respectively.

Already the response has been an eye opener, starting with an email from Glen Campbell that he has since posted, in its entirety, on his blog, My Pencil. What he says confirms my suspicions in the extreme...

I have always been acutely aware of the gap between the IT/IS industry and what I call the "high-tech" world, having straddled the edges of both of them for about 20 years now. What you encountered at the ISACA conference is a classic instance of this. One thing that open source advocates so often miss out (and I'm in the open-source community: see http://siteframe.org) is that the largest driving factor in most Fortune 2000 IT shops is risk mitigation. An example: a year or so ago I worked as a contractor at a large bank in San Francisco. They have a thousand or more Sun servers doing their web serving: they are running essentially nothing except Apache. I mentioned to one of their IT directors that they could save tons of money by using whitebox servers running Linux and the same Apache code. His response? "Yeah, but then there wouldn't be anyone we could sue." He was deadly serious: the ablity to pass along some of the risk is far more important than cost or implementation ease. In the open-source world, name one company that's large enough to assume some of the risk for a Fortune2000 firm: maybe IBM on some of their Linux implementations, but that's about it. And IBM doesn't create (or warrant) open-source software, they merely distribute it.

Likewise, the whole concept of DIY-IT is a complete anachronism to most IT shops. They did DIY-IT in the 60's, 70's, and 80's, and discovered that, no only is it less expensive to outsource their internal systems (to SAP, or Siebel, or EDS, or IBM), it also - tada! - reduces their risk in that there's another large corporation out there that they can sue if something goes wrong.

So I'm looking for more stories here, more perspectives. Does this square with your experience? How does one IT shop differ frm the next? How can we construct a Venn diagram with overlaps between open source and DIY-IT in one circle and BigCo IT on the other?